[Unsubtyping] Handle table.grow (#9327)

SubtypingDiscoverer did not previously note the constraint that
TableGrow's `value` operand had to be a subtype of the table's element
type. This would cause Unsubtyping to incorrectly remove that subtyping,
leading to validation failures.

This is included in #9263, but split it out to make the fuzzer happy.

Author: tlively

src/ir/subtype-exprs.h

@@ -252,7 +252,10 @@ struct SubtypingDiscoverer : public OverriddenVisitor<SubType> {
                         self()->getModule()->getTable(curr->table)->type);
   }
   void visitTableSize(TableSize* curr) {}
-  void visitTableGrow(TableGrow* curr) {}
+  void visitTableGrow(TableGrow* curr) {
+    self()->noteSubtype(curr->value,
+                        self()->getModule()->getTable(curr->table)->type);
+  }
   void visitTableFill(TableFill* curr) {
     self()->noteSubtype(curr->value,
                         self()->getModule()->getTable(curr->table)->type);

test/lit/passes/unsubtyping.wast

@@ -762,6 +762,37 @@
  )
 )
 
+(module
+ ;; CHECK:      (rec
+ ;; CHECK-NEXT:  (type $super (sub (struct)))
+ (type $super (sub (struct)))
+ ;; CHECK:       (type $sub (sub $super (struct)))
+ (type $sub (sub $super (struct)))
+
+ ;; CHECK:       (type $2 (func))
+
+ ;; CHECK:      (table $t 1 1 (ref null $super))
+ (table $t 1 1 (ref null $super))
+
+ ;; CHECK:      (func $table-grow (type $2)
+ ;; CHECK-NEXT:  (drop
+ ;; CHECK-NEXT:   (table.grow $t
+ ;; CHECK-NEXT:    (struct.new_default $sub)
+ ;; CHECK-NEXT:    (i32.const 0)
+ ;; CHECK-NEXT:   )
+ ;; CHECK-NEXT:  )
+ ;; CHECK-NEXT: )
+ (func $table-grow
+  ;; This requires $sub <: $super.
+  (drop
+   (table.grow $t
+    (struct.new $sub)
+    (i32.const 0)
+   )
+  )
+ )
+)
+
 (module
  ;; CHECK:      (rec
  ;; CHECK-NEXT:  (type $super (sub (struct)))